In the Linux kernel, the following vulnerability has been resolved:
netfs: Fix barriering when walking subrequest list
Fix the barriering used when walking the subrequest list in retry as
there's a possibility of seeing a subreq that's just been added by the
application thread.
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8
AV:N - The flaw is in the netfs client retry path used by SMB/CIFS, Ceph, NFS+fscache, and AFS; a remote malicious or MITM file server can trigger NEED_RETRY via short/error network responses during client read/write I/O.
AC:L - The attacker controls both sides of the race by timing retry-inducing server responses and issuing concurrent reads/writes (multiple threads/fds); no victim-specific memory layout or rare uncontrollable state is required beyond normal mounted-FS I/O.
PR:N - No local privileges on the victim are required; a remote attacker operating a malicious or compromised SMB/Ceph/NFS/AFS server can exploit any client with an active mount performing file I/O, without shell or admin access on the client.
UI:N - On commonly pre-mounted enterprise/automounted network shares, kernel readahead and writeback can reach the buggy retry path without additional victim action at exploitation time beyond existing background file access.
S:U - Exploitation corrupts the client kernel heap and enables local privilege escalation within the same kernel security domain; it does not by itself cross a VM/host or IOMMU boundary.
C:H - Observing partially published subrequest entries yields stale start/len/flags/io_iter values, causing out-of-bounds kernel reads and information disclosure from adjacent memory via mis-sized iterators.
I:H - Corrupted subrequest metadata drives wrong-span reissue_read/write, erroneous list deletion, and refcount manipulation, providing heap corruption primitives that can be leveraged for arbitrary kernel writes and code execution.
A:H - Incorrect list traversal and mis-issued I/O can cause use-after-free, refcount underflow, kernel oops, or panic, reliably crashing or hanging the affected system.
| Attack Vector |
Network |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
None |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:N - The flaw is in the netfs client retry path used by SMB/CIFS, Ceph, NFS+fscache, and AFS; a remote malicious or MITM file server can trigger NEED_RETRY via short/error network responses during client read/write I/O.
AC:L - The attacker controls both sides of the race by timing retry-inducing server responses and issuing concurrent reads/writes (multiple threads/fds); no victim-specific memory layout or rare uncontrollable state is required beyond normal mounted-FS I/O.
PR:N - No local privileges on the victim are required; a remote attacker operating a malicious or compromised SMB/Ceph/NFS/AFS server can exploit any client with an active mount performing file I/O, without shell or admin access on the client.
UI:N - On commonly pre-mounted enterprise/automounted network shares, kernel readahead and writeback can reach the buggy retry path without additional victim action at exploitation time beyond existing background file access.
S:U - Exploitation corrupts the client kernel heap and enables local privilege escalation within the same kernel security domain; it does not by itself cross a VM/host or IOMMU boundary.
C:H - Observing partially published subrequest entries yields stale start/len/flags/io_iter values, causing out-of-bounds kernel reads and information disclosure from adjacent memory via mis-sized iterators.
I:H - Corrupted subrequest metadata drives wrong-span reissue_read/write, erroneous list deletion, and refcount manipulation, providing heap corruption primitives that can be leveraged for arbitrary kernel writes and code execution.
A:H - Incorrect list traversal and mis-issued I/O can cause use-after-free, refcount underflow, kernel oops, or panic, reliably crashing or hanging the affected system.
CVSS 3.1